Inconsistent implementations of a hashing function for SSO cached secrets between different SDKs
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Introduction
After successfull SSO auth, a cache is saved to files with with the following path:
`~/.aws/sso/cache/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.json`, where "xxxxx..." is a hash derived from some fields of a profile.
# Describe the problem
It appears that there's no standard way of calculating this hash. Different AWS SDKs have different implementations, to list a few that I've checked (links point directly to implementations):
| SDK | hash function |
| --- | --- |
| [botocore](https://github.com/boto/botocore/blob/1eaa8aed894ce6d3cbfd038a358f2dfe55444926/botocore/credentials.py#L2096) | sha1 a json containing [`sso_start_url` or session name], roleName, accountId |
| [aws-sdk-cpp](https://github.com/aws/aws-sdk-cpp/blob/c005754b0c854373b7be208542e204c938da3c0c/src/aws-cpp-sdk-core/source/auth/SSOCredentialsProvider.cpp#L60) | sha1 a `sso_start_url` |
| [aws-sdk-go (v1)](https://github.com/aws/aws-sdk-go/blob/5eaabf6fe3cc4d62e2e1728d44cffc43092371c8/aws/credentials/ssocreds/provider.go#L150) | sha1 of `sso_start_url` |
| [aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2/blob/7177df0f8b7b264c5d5f0939ca23e5a0d43636cf/credentials/ssocreds/sso_credentials_provider.go#L98) | sha1 of `sso_start_url` |
| [aws-sdk-java-v2](https://github.com/aws/aws-sdk-java-v2/blob/81d0e84597487a6a55a392e343a6f45b36784172/services/sso/src/main/java/software/amazon/awssdk/services/sso/internal/SsoTokenFileUtils.java#L51) | sha1 of `sso_start_url` |
| [aws-sdk-net](https://github.com/aws/aws-sdk-net/blob/d85a9c0bfb7dca401583436b0072a5b6a4bcae81/sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SSOTokenFileCache.cs#L310) | sha1 of [`sso_start_url` OR session name] |
See the example below for why exactly this is a problem.
# Proposed solution
Enforce a single, standard way of calculating this hash it across all SDKs.
# Example instance of this problem
My team uses aws cli (botocore SDK) to authenticate to AWS via SSO, and right now we're trying to configure Nix binary cache which is stored on s3. We're unable to authenticate Nix tool, because Nix (which uses aws-sdk-cpp) can't read secrets created by `aws sso login` due to a mismatch of secret filenames.
Contributor guide
Research direction
Start by comparing the linked implementations in botocore/credentials.py, SSOCredentialsProvider.cpp, the Go ssocreds provider files, SsoTokenFileUtils.java, and SSOTokenFileCache.cs. Determine the compatibility requirements from the cache filename example and verify that the proposed standard produces matching filenames across SDKs; done means aws sso login credentials can be read by the listed SDKs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, cpp, csharp, go, java, python
- Domain
- authentication, cli, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100